Vulnerability in Amazon Amplify Cli
CVE-2024-28056
Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.017 (75.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 75.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1 (Release Notes)
- github.com/aws-amplify/amplify-cli/commit/73b08dc424db2fb60399c5343c314e02e849d… (Patch)
- github.com/aws-amplify/amplify-cli/blob/8ad57bf99a404f3c92547c8a175458016f682fa… (Product, Exploit)
- securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-ampli… (Exploit, Third Party Advisory)
- aws.amazon.com/security/security-bulletins/AWS-2024-003/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-28056?
- CVE-2024-28056 is a critical-severity vulnerability in Amazon Amplify Cli, classified under Incorrect Default Permissions. CVSS score: 9.8/10. Published 2024-04-15.
- How severe is CVE-2024-28056?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2024-28056 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.